The FBI is urging supermarkets and other businesses that use refrigeration systems to take those installations off the internet immediately. The warning was issued together with CISA and the US Departments of Health, Agriculture and Transport. It follows recent attacks on cooling systems at European supermarkets.
The attacked systems were reachable by anyone on the internet, lacked important security updates and still used default passwords. Attackers then changed the temperature of the cooling installations, forcing supermarkets to throw away large amounts of food.
According to the US agencies, the consequences could go further. The lifespan of the system could be affected, a fire could start, and people could fall ill after eating spoiled food.
The agencies call for immediate measures. Make sure control systems are not directly accessible from the internet, and create a separate virtual local area network (VLAN) for operational technology (OT) systems. Replace default passwords with strong ones, install patches and monitor systems for suspicious activity.
The lesson for you is that basic hygiene matters. An exposed system with a default password is an open invitation, and OT systems deserve the same attention as regular IT. Check which of your own systems can be reached from the internet and fix that first.
